Tag: operational security

When will hedge funds become interested in the security posture of a company?

When will hedge funds become interested in the security posture of a company?

By | | Comments 0 Comment

At some point the security posture of a company will be of great interest to hedge funds and investment managers. That is to say that they will be interested in how secure other companies will be and whether that can affect their investments.

The companies of interest are more likely to be a publicly listed company, although it could be of concern for investment managers looking to acquire a share of a private company. For hedge funds and other managers with an appetite for more exotic investment vehicles the security posture of a company could indicate a potential shorting opportunity (making profit from the decline in a company’s share price).

…

Read More Read More

The people behind malware and cybercrime

The people behind malware and cybercrime

By | | Comments 0 Comment

As interesting as the techniques used in creating new malware are the people behind the code and the lengths they go to in order to hide themselves. The malware writers are a small but important piece of the puzzle however they are part of a wider category of cybercriminal.

In this piece I explore some of the people behind well known malware and other cybercrimes. Some people, and their actions, may be defined as criminal in a true legal sense but I make no statement on the morality of them. Is cyber-vigilantism justified (“doing right”) even if the actions are illegal? I have my own opinion but here I will try to stick to report facts with some opinion of personalities rather than of their morality.

…

Read More Read More

Wikileaks releases a new dump from the CIA – hacking tools – Vault 7

Wikileaks releases a new dump from the CIA – hacking tools – Vault 7

By | | Comments 0 Comment

I’m losing track of all the leaks that have happened at US government agencies. It seems that yet another load of information has been shared to Wikileaks. This batch of data supposedly carries hacking tools. It seems there is a lot of policy and procedure documents including checklists for secure development.

Wikileaks Vault 7 — A link to the information dump. Caution: some of the information is classified (if this applies to you then you will know that already). Some of the information also been redacted for now.

Scheier’s comments — Bruce and the commenters often provide interesting thoughts and insight.

One interesting thing that Bruce pointed out:

Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized “zero day” exploits, malware remote control systems and associated documentation.

…

Read More Read More

Uber’s fake app providing anonymity to drivers?

Uber’s fake app providing anonymity to drivers?

By | | Comments 0 Comment

An interesting revelation was dropped in the news this week about Uber implementing a mechanism to provide some level of protection from law enforcement in cities where Uber is prohibited (if I have understood correctly). It would seem that the mechanism affords the driver a level of anonymity.

Bruce Schneier wrote a comment on the revelation and focussed on the surveillance aspect of this. While I’m a fan of Bruce, I’m less inclined to focus on the surveillance aspect of this story and look more at the ‘anonymising protocol’ employed by the app. Interestingly, while Bruce was critical of Uber it would seem that many of the commenters defended Uber’s actions.

…

Read More Read More

Password Managers – Local vs Global

Password Managers – Local vs Global

By | | Comments 0 Comment

I’ve written a few articles already about the need for better passwords and the necessity of using a password manager. In this article I will point out why I think a local password manager is better.

Local

A local password manager is one that sits upon one device and does not back up to the cloud or anywhere remote location automatically. My own preference is to use something which is as simple as possible. This minimises the possible attack surface in case the password management software has a flaw. Let me recap what my password manager does / is:

  • Save my passwords in an encrypted file
  • The software is local to my computer
  • There is a automatic backup file which is saved locally
  • I can copy / paste the usernames and passwords

The password file is only saved to the computer on which I’m working. I have one manager on my work computer and one on my personal computer. There is no saving of passwords to the cloud, nor do the password managers have any sort of remote connectivity.

The software only saves passwords. That’s it. Nothing more. Let me outline why this is best.

…

Read More Read More